gptoto Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how gptoto ("we," "us," or "our") collects, uses, processes, stores, discloses, and protects the personal information of users ("you" or "your") who access or use the gptoto platform at https://gptoto.cam. This Policy applies to all services offered by gptoto, including sports betting, live casino, togel (Indonesia's traditional numbers lottery), slot games, and all associated customer support and account management functions.

By creating a gptoto account or continuing to use the gptoto platform, you acknowledge that you have read this Policy in full and consent to the collection and use of your personal data as described herein. If you do not agree with any provision of this Policy, you must discontinue use of the platform immediately.

This Policy should be read together with the gptoto Terms & Conditions and our Responsible Gaming Policy, both of which form part of your agreement with gptoto.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, phone number, residential address, government-issued identification number, and financial account details.
• "Processing" means any operation performed on personal data, including collection, recording, organisation, storage, retrieval, use, disclosure, and deletion.
• "Data Controller" means gptoto, the entity that determines the purposes and means of processing your personal data.
• "KYC" means Know Your Customer — the identity and document verification process required before withdrawal of funds from a gptoto account.
• "Cookies" means small text files placed on your device by the gptoto platform to enable certain functionality and to collect analytics data.

3. Information We Collect

3.1 Information You Provide Directly

When you register for a gptoto account, you provide us with the following personal data:

• Full legal name (as it appears on your government-issued identification).
• Date of birth (used to verify that you meet the 21+ age requirement).
• Email address and phone number.
• Residential address (including city and province, e.g., Jakarta, Surabaya, Bandung, Bali).
• Preferred payment method details (e.g., BCA, BRI, BNI, Mandiri, or e-wallet account details such as OVO or DANA).
• Username and password (password is stored in hashed, encrypted form).

During KYC verification, you may also be required to submit:

• A copy of a government-issued photo ID (e.g., KTP, passport, or driver's license).
• Proof of residential address (e.g., recent utility bill or bank statement).
• Proof of payment method ownership (e.g., a screenshot of your bank account registered in your name).
• Selfie photograph for facial verification (where required for higher withdrawal limits).

3.2 Information Collected Automatically

When you use the gptoto platform, we automatically collect certain technical and behavioural data, including:

• IP address and approximate geographic location (city-level).
• Device type, operating system, and browser version.
• Pages visited, features used, and session duration on the gptoto platform.
• Bet history, deposit and withdrawal transaction records, and game activity logs.
• Cookie identifiers and local storage data (see Section 9 — Cookies).

3.3 Information from Third Parties

In limited circumstances, gptoto may receive personal data about you from third parties, including:

• Payment processors and banks (e.g., transaction confirmation data from BCA, BRI, or BNI systems).
• Fraud prevention and identity verification service providers.
• Responsible gaming self-exclusion registries, where you have registered with such a service.

4. How We Use Your Information

gptoto processes your personal data for the following purposes, each grounded in a lawful basis:

Purpose	Lawful Basis
Account creation, login authentication, and account management	Performance of contract
Processing deposits and withdrawals (BCA, BRI, OVO, DANA, etc.)	Performance of contract
KYC identity verification and age verification (21+ requirement)	Legal obligation / Performance of contract
Fraud prevention, anti-money-laundering (AML) monitoring	Legal obligation / Legitimate interest
Customer support and dispute resolution	Performance of contract / Legitimate interest
Responsible gaming monitoring and intervention	Legal obligation / Legitimate interest
Platform improvement, analytics, and bug fixing	Legitimate interest
Sending account security notifications and service updates	Performance of contract / Legitimate interest
Sending promotional offers and bonus notifications (where opted in)	Consent

5. Disclosure of Your Information

5.1 Service Providers

gptoto may share your personal data with trusted third-party service providers who assist us in operating the platform. These include payment processing partners (such as Indonesian banks and e-wallet providers), identity verification providers, cloud hosting and infrastructure providers, and customer support software vendors. All third-party service providers are contractually bound to process your data only on gptoto's instructions and in accordance with this Policy.

5.2 Legal and Regulatory Authorities

We may disclose your personal data to law enforcement agencies, regulatory authorities, or legal counsel where we are required to do so by applicable law, court order, or to protect the legal rights and safety of gptoto, its users, or the public.

5.3 Business Transfers

In the event that gptoto is involved in a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred to the acquiring entity. You will be notified via email and/or prominent notice on the gptoto platform before any such transfer takes effect, and you will be informed of any changes to this Policy that result from the transfer.

5.4 No Marketing Data Sales

gptoto does not sell, lease, rent, or otherwise share your personal data with third parties for their direct marketing purposes. Any promotional communications you receive from gptoto are sent directly by us, and you may opt out at any time by clicking the unsubscribe link in any marketing email or by contacting support.

6. Data Retention

gptoto retains your personal data for as long as your account remains active, and for a period of seven (7) years following account closure or your last transaction, whichever is later. This retention period is necessary to comply with Indonesian financial record-keeping regulations, anti-money-laundering (AML) requirements, and to defend potential legal claims.

After the applicable retention period expires, your personal data will be securely deleted or anonymised such that you can no longer be identified from it. KYC documents (identification cards, utility bills, selfies) are retained separately under strict access controls and are deleted no later than ten (10) years after account closure.

7. Your Rights

Under applicable data protection principles, you have the following rights with respect to your personal data held by gptoto:

To exercise any of these rights, please contact the gptoto Data Protection Officer at [email protected] with the subject line "Data Rights Request". We will respond within 30 days.

8. Security Measures

gptoto implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, loss, misuse, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and gptoto servers.
• Database encryption at rest using AES-256 encryption for all stored personal data.
• Access controls and role-based permissions limiting data access to authorised personnel only, with audit logging of all access events.
• Two-factor authentication (2FA) available for user accounts to prevent unauthorised login.
• Regular security audits and penetration testing conducted by independent third-party security firms.
• DDoS protection and firewalls to prevent malicious attacks against the gptoto platform.

While we take every reasonable precaution to protect your data, no method of transmission over the internet or method of electronic storage is 100% secure. You acknowledge that you provide personal data at your own risk. gptoto cannot guarantee absolute security, but we will notify you promptly in the event of any data breach that may affect your personal information.

9. Cookies and Tracking Technologies

The gptoto platform uses cookies and similar tracking technologies to enhance user experience, analyse site usage, and deliver personalised content. Cookies are small text files stored on your device that allow us to recognise you when you return to the site.

Types of Cookies We Use:

• Strictly Necessary Cookies: Essential for the operation of the site (e.g., session authentication, security features). These cannot be disabled without affecting core functionality.
• Performance and Analytics Cookies: Help us understand how users interact with the platform, which pages are most popular, and where errors occur. We use this data to improve the platform.
• Functional Cookies: Remember your preferences (e.g., language settings, display preferences) to provide a more personalised experience.
• Advertising Cookies: Used to deliver relevant promotional content. You may opt out of these via your browser settings.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may limit your ability to use some features of the gptoto platform. For more information on managing cookies, consult your browser's help documentation.

10. International Data Transfers

gptoto operates servers and engages service providers that may be located outside of Indonesia. When we transfer your personal data internationally, we ensure that such transfers are protected by appropriate safeguards, such as standard contractual clauses or binding corporate rules, in accordance with international data protection standards.

By using the gptoto platform, you consent to the transfer of your personal data to countries outside Indonesia where data protection laws may differ from those in your jurisdiction.

11. Children's Privacy

The gptoto platform is not intended for individuals under the age of 21. We do not knowingly collect personal data from minors. If we become aware that a user is under 21 years of age, we will immediately suspend the account and delete all associated personal data. If you believe a minor has created a gptoto account, please contact us immediately at [email protected].

12. Changes to This Privacy Policy

gptoto reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes to this Policy, we will notify you by email (to the address registered on your account) and by posting a prominent notice on the gptoto platform at least 14 days before the changes take effect.

Your continued use of the gptoto platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically to stay informed about how we are protecting your data.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact the gptoto Data Protection Team:

Email: [email protected]
Subject Line: Privacy Policy Inquiry
Live Chat: Available 24/7 via the gptoto platform
WhatsApp: Available 08:00–24:00 WIB (Western Indonesia Time)

We are committed to resolving any privacy-related concerns in a timely and transparent manner. All inquiries will receive a response within 30 days.

14. Governing Law

This Privacy Policy is governed by and construed in accordance with international data protection standards applicable to the gptoto operating jurisdiction. Any disputes arising from or relating to this Policy shall be resolved in accordance with the dispute resolution provisions set forth in the gptoto Terms & Conditions.

By using the gptoto platform, you acknowledge that you have read, understood, and agree to the collection and use of your personal data as described in this Privacy Policy.